PCCSE flashcards
PCCSE · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Prisma Cloud Console
- SaaS control plane that manages cloud accounts, policies, alerts, and compute defenders; it provides the UI and API for CSPM, CIEM, DSPM, and code security.
- Defender
- Lightweight agent deployed on hosts, containers, or serverless functions that enforces runtime policies and sends events to the Prisma Cloud Console or Defender Manager.
- Agentless scanning
- Prisma Cloud capability that uses cloud provider APIs and disk snapshots to scan workloads for vulnerabilities and malware without installing a Defender agent.
- Defender Manager
- Optional Prisma Cloud Compute component that brokers Defender connections, distributes upgrades, and reduces load on the Console for large deployments.
- AWS cross-account role
- IAM role created in the target AWS account with a trust policy allowing Prisma Cloud; the Console uses its ARN and external ID to assume read-only access.
- Azure service principal
- App registration and client secret used by Prisma Cloud to authenticate to Azure; assign Reader and Security Reader roles at subscription scope for onboarding.
- Account group
- Logical container of cloud accounts used to scope policies, alert rules, and RBAC; an account can belong to only one account group in Prisma Cloud.
- Organization onboarding
- Cloud account onboarding mode that covers all current and future accounts in an AWS Organization, Azure tenant, or GCP organization using a single read-only role.
- RQL
- Resource Query Language used in Prisma Cloud to query cloud resources and define config policies; queries start with config from cloud.resource where conditions.
- Config policy
- Prisma Cloud policy type evaluated against cloud resource configuration using RQL; findings generate alerts when resources violate the rule.
- Policy exception
- Allowlist that suppresses a policy finding for specified resources, accounts, or tags, usually with an expiration date and justification.
- Compliance standard mapping
- Association of a Prisma Cloud policy with one or more frameworks such as CIS, PCI DSS, HIPAA, SOC 2, NIST, or ISO 27001 for compliance reporting.
- Central policy
- Policy defined at the tenant level and inherited by all enterprise groups; child enterprise groups cannot edit or delete it.
- Alert rule
- Prisma Cloud configuration that filters alerts by policy, severity, account group, or resource and sends notifications to integrations such as Slack or ServiceNow.
- Alert lifecycle
- Prisma Cloud alert states include open, resolved, and dismissed; resolved indicates remediation, while dismissed suppresses the alert with a reason.
- Investigate page
- Prisma Cloud workspace where analysts run RQL queries against cloud resources, save searches, and export findings for troubleshooting.
- Risk score
- Prisma Cloud prioritization metric that combines alert severity with resource exposure, network accessibility, and identity context to rank investigations.
- Notification integration
- Configured destination for Prisma Cloud alerts, such as email, Slack, Microsoft Teams, PagerDuty, ServiceNow, webhook, syslog, or cloud storage.
- Container Defender
- Prisma Cloud Compute agent deployed as a container or DaemonSet on Kubernetes nodes; it enforces runtime policies and scans local images.
- Host Defender
- Compute agent installed on Linux or Windows hosts to monitor processes, file integrity, vulnerabilities, and compliance outside container orchestration.
- Admission control
- Kubernetes integration where the Defender validates pod creation requests against Prisma Cloud vulnerability and compliance policies before allowing deployment.
- Registry scanning
- Prisma Cloud Compute feature that connects to image registries such as ECR, ACR, GCR, Harbor, or Docker Hub and scans images for vulnerabilities.
- Collection
- Compute scope that groups hosts, containers, images, or functions by labels, namespaces, or accounts for policy assignment and RBAC.
- Code Security
- Prisma Cloud module that scans infrastructure-as-code repositories and pull requests for misconfigurations and policy violations before deployment.
- IaC scanning
- Build-time analysis of Terraform, CloudFormation, Kubernetes, Helm, ARM, or Serverless Framework templates against Prisma Cloud code policies.
- twistcli
- Prisma Cloud Compute command-line tool used in CI/CD pipelines to scan container images and serverless functions and optionally fail builds.
- CI/CD integration
- Connection between Prisma Cloud and tools such as Jenkins, GitHub Actions, GitLab CI, or Azure DevOps to scan artifacts during build and deploy.
- Fix pull request
- Code Security feature that proposes a pull request with corrected infrastructure-as-code to remediate a detected misconfiguration in the repository.
- System Admin
- Prisma Cloud RBAC role with full tenant access, including user management, enterprise groups, cloud accounts, policies, and integrations.
- Enterprise group
- Hierarchical Prisma Cloud container for account groups and policies; settings and RBAC inherit downward from the tenant root.
- SAML SSO
- Prisma Cloud authentication integration using SAML 2.0 with an identity provider; IdP groups can map to Prisma Cloud roles.
- Audit log
- Prisma Cloud record of user and API actions, including policy changes and logins, exportable to SIEM tools for monitoring and compliance.